Yesterday, Diego Dzodan, Facebook's Vice President for Latin America, was arrested at his Sao Paolo home by federal police, escorted to a forensic institute and then held at Pinheiros Provisional Detention Center in the city. His arrest was ordered by Judge Marcel Montalvão, who was been demanding personal data from WhatsApp as part of a drug-related investigation in Brazil's northeastern state of Sergipe. The arrest comes after the judge had begun serving WhatsApp, which is owned by Facebook, a series of fines for withholding information from the court.
Davi Tangerino, WhatsApp's lawyer, told reporters what he told the court: WhatsApp can't provide the contents of the communications, because the company has no record of those communications. That may be for technological reasons—many WhatsApp communications are end-to-end encrypted. It may also be result of the companies own logging policies: WhatsApp says it makes no permanent record of the data that the court requires. In either case, the court is punishing a single employee for the court's own impossible demands.
Even if WhatsApp had the data, the Brazilian court could not expect the company to hand it over without going through official channels. Facebook, like all US-based companies, must also comply with U.S. privacy law. This includes the Electronic Communications Privacy Act (ECPA) which forbids companies from disclosing communications content without a warrant issued by a US judge. What is the Brazilian court supposed to do in such a situation? The court has access to an international legal procedure to obtain such a warrant via the US-Brazil Mutual Legal Assistance Treaty (MLAT). Many countries' prosecutors have expressed frustration with the MLAT process, which can be slow and requires non-US courts to understand and convincingly reach the American “probable cause” standard of suspicion necessary for a warrant to be granted. Nonetheless, that is the international procedure agreed upon to allow data to be passed by law-enforcement.
There's a parallel here with what is happening in the United States in the Apple San Bernardino case. In both cases, prosecutors are seeking to bend to their will precedent, technology, and technology companies in the pursuit of high-profile targets. Judges cannot expect companies to break the laws of mathematics, nor retrospectively rewrite their entire application in pursuit of prosecutorial aims. And neither can they expect those companies to stride deliberately into legal paradoxes, where complying with a court demand in one country would lead them to violate the law in another.
In the face of resolving these impossible claims, imprisoning a Facebook executive does no good for the case. He can neither hand over the data the court needs, nor evade the international agreements to which the judge objects.
Diego Dzodan was freed earlier today, after another Brazilian judge called his incarceration “unlawful coercion." His experience joins the litany of random acts of short-lived punishments that Brazil's judiciary continues to hurl at tech companies and their users. These arbitrary sanctions don't get the courts the data they believe they deserve, they don't respect the technical privacy protections that shield millions of innocent Brazilians, and they don't respect international legal process. Marcel Montalvão, as a judge should understand that while justice is sometimes slow, it cannot be served through shortcuts, bullying, and impossible demands. Brazilian Internet users, and Brazil's justice system, deserve better.
